Bug 1344232 (CVE-2016-4972)

Summary:	CVE-2016-4972 openstack-murano: RCE via usage of insecure YAML tags
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abaron, aortega, apevec, ayoung, chrisw, jjoyce, jschluet, kbasil, lars, lhh, lpeer, markmc, mburns, rbryant, sclewis, security-response-team, slinaber, slong, srevivo, tdecacqu
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was discovered in openstack-murano processing. Using extended YAML tags in Murano-application YAML files, an attacker could perform remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-06-24 00:07:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1349665, 1349666
Bug Blocks:	1344240

Description Andrej Nemec 2016-06-09 08:45:38 UTC

Kirill Zaitsev from Mirantis reported a vulnerability in OpenStack Murano applications processing. Using extended YAML tags in Murano application YAML files, an attacker can perform Remote Code Execution.

Comment 1 Andrej Nemec 2016-06-09 08:45:48 UTC

Acknowledgments:

Name: Kirill Zaitsev (Mirantis)

Comment 2 Summer Long 2016-06-23 23:17:29 UTC

Upstream announcement: http://seclists.org/oss-sec/2016/q2/593
From: Kirill Zaitsev <k.zaitsev () me com>
Date: Thu, 23 Jun 2016 20:42:13 +0300

Comment 5 Summer Long 2016-06-23 23:37:15 UTC

Statement:

Red Hat OpenStack Platform and Red Hat Enterprise Linux OpenStack Platform do not include or support openstack-murano, and are therefore not affected by this flaw in any supported configuration.